This policy explains what personal data sanjaysokal.com collects, why it is collected, who else can see it, and what you can do about it. It is written to describe what the site actually does, not what a generic template assumes it does.
1. Who is responsible for your data
sanjaysokal.com is a personal website and blog operated by Sanjay Sokal, based in Khairoli, Mahendergarh, Haryana, 123028. For the purposes of data-protection law, Sanjay Sokal is the data controller (or, under India's Digital Personal Data Protection Act, 2023, the Data Fiduciary) for the data described below.
You can reach the controller at sokalsanjay@gmail.com.
2. What data is collected
2.1 Data you choose to give
The only place on this site where you actively submit data is the comment form on blog posts. When you post a comment, the following is stored:
- Name — required, and published next to your comment if it is approved.
- Email address — required, used only to identify you and reply if necessary. It is never published on the site and never sold, rented or shared for marketing.
- Website URL — optional.
- The comment text itself.
- Your IP address and browser user-agent string — recorded automatically with the comment for spam prevention and abuse investigation.
- Timestamp of submission.
Comments are held in a moderation queue and are not visible to anyone but the site owner until approved. If you email the site owner directly, that email and its contents are of course also retained in the owner's mailbox.
There is no newsletter, no account registration, and no contact form on the public site. No payment data is ever collected, because nothing is sold here.
2.2 Data collected automatically
This site runs its own first-party, self-hosted page-view analytics. No third party receives this data. For each page view of a public page, the following is recorded:
- The page path visited (for example
/blog/some-article) and the site title - The referring URL, if you arrived from another website (referrers from this same site are discarded)
- Your browser user-agent string, plus a derived browser name and device category (Desktop / Mobile / Tablet)
- Your IP address
- An identifier taken from the site's own session cookie, used to tell repeat views apart from distinct visitors
- A flag marking the request as automated, if the user-agent looks like a search-engine crawler or bot
- The date and time of the request
Requests to the admin area, the RSS feed, the sitemap, robots.txt and static asset
files are excluded from analytics entirely, as are all non-GET requests.
This analytics data is not used to build advertising profiles and is
never combined with data from other websites.
Separately, the web server and the application keep standard error logs, which may contain an IP address and request path when something goes wrong. These exist for debugging and security.
2.3 Cookies
This site sets one first-party cookie of its own and may permit third-party cookies from Google's advertising and analytics services. The complete list, with names, purposes and lifetimes, is in the separate Cookie Policy.
3. How the data is used
| Purpose | Data used |
|---|---|
| Publishing and moderating comments | Name, email, website, comment text, IP, user-agent |
| Preventing spam and abuse | IP address, user-agent, honeypot field, comment content |
| Understanding which articles are read, and from where | Page path, referrer, device/browser, session identifier |
| Keeping you signed in (site owner only) | Session cookie |
| Diagnosing errors and keeping the site online | Server and application logs |
| Showing advertisements | Handled by Google — see section 5 |
Your data is not used for automated decision-making or profiling that produces legal effects, and it is never sold.
4. Legal basis for processing
Where the GDPR or UK GDPR applies to you, the legal bases relied on are:
- Consent (Art. 6(1)(a)) — for non-essential analytics and advertising cookies, and for submitting a comment.
- Legitimate interests (Art. 6(1)(f)) — for basic security logging, spam prevention and keeping the site functioning.
- Legal obligation (Art. 6(1)(c)) — where data must be retained or disclosed under applicable law.
Where India's Digital Personal Data Protection Act, 2023 applies, processing is carried out on the basis of your consent, or for the legitimate uses permitted under that Act. You may withdraw consent at any time using the contact details in section 14.
5. Advertising and Google AdSense
This site may display advertisements served by Google AdSense. When ads are enabled:
- Google and its partners use cookies and similar technologies to serve ads based on your prior visits to this and other websites.
- Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.
- Third-party vendors, including Google, may use cookies to serve ads based on a user's prior visits.
- The site owner does not receive, store or have access to the personal data Google collects for advertising.
You may opt out of personalised advertising at Google Ads Settings, or opt out of some third-party vendors' use of cookies at aboutads.info/choices and youronlinechoices.com. Google's own handling of data is described in the Google Privacy & Terms.
6. Third-party services this site loads
Some resources are loaded from other providers' servers. Because of how the web works, those providers necessarily receive your IP address and basic request headers when your browser fetches the file. They are:
| Provider | What is loaded | Their policy |
|---|---|---|
| Google Fonts | The Inter typeface | Policy |
| Google AdSense | Advertising scripts, when ads are enabled | Policy |
| Google Analytics | Measurement script, when a tracking ID is configured | Policy |
| jsDelivr / unpkg (CDNs) | Stylesheet and icon libraries used by the site's interface | Policy |
Beyond these, no data is shared with anyone, except where disclosure is legally required.
7. How long data is kept
- Comments (and the name, email, IP and user-agent attached to them) are kept for as long as the post they belong to remains published, unless you ask for removal.
- Analytics events are kept for as long as they remain useful for understanding site traffic, and are deleted or aggregated when they no longer are.
- Server and error logs are kept for a short operational period and then rotated or deleted.
- Session cookies expire after 7 days, or sooner if you clear them.
8. How data is protected
- The whole site is served over HTTPS.
- Database access uses parameterised queries throughout, and administrator passwords are stored only as bcrypt hashes — never in plain text.
- Every state-changing action in the admin area requires a CSRF token.
- Application source, configuration and log directories are blocked from direct web access, and script execution is disabled in the uploads directory.
- Session cookies are marked
HttpOnlywithSameSite=Lax.
No system is perfectly secure. If you believe you have found a vulnerability, please report it privately to sokalsanjay@gmail.com rather than disclosing it publicly.
9. Your rights
Depending on where you live, you may have the right to:
- Access the personal data held about you
- Correct data that is inaccurate or incomplete
- Erase your data — for example, have a comment and everything attached to it deleted
- Restrict or object to processing
- Withdraw consent at any time, without affecting processing already carried out
- Data portability — receive your data in a machine-readable format
- Nominate another person to exercise these rights on your behalf, in the event of death or incapacity (DPDP Act, 2023)
- Complain to a supervisory authority — the Data Protection Board of India, or your local EU/UK authority
To exercise any of these, email sokalsanjay@gmail.com with enough detail to locate your data (for a comment, the post URL and the name you used). Requests are answered free of charge, normally within 30 days.
California residents: this site does not sell or share personal information as those terms are defined by the CCPA/CPRA, and you will never be discriminated against for exercising a privacy right.
10. Children's privacy
This site is not directed at children, and data is not knowingly collected from anyone under 18. If you believe a child has submitted personal data here — for example through a comment — contact sokalsanjay@gmail.com and it will be deleted promptly.
11. International visitors and data transfers
This site is operated from Khairoli, Mahendergarh, Haryana, 123028. The hosting infrastructure, and the third-party services listed in section 6, may store or process data on servers outside your country, including in the United States. Where required, such transfers rely on the recipients' own approved transfer mechanisms, such as the EU Standard Contractual Clauses. By using this site, you understand your data may be processed in a country other than your own.
12. Links to other websites
Articles, project pages and advertisements on this site link to third-party websites. Once you follow such a link, this policy no longer applies — you are subject to the privacy policy of the site you land on. Those sites are not controlled by, and are not the responsibility of, the owner of sanjaysokal.com.
13. Changes to this policy
This policy may be updated as the site changes or as the law does. The “Last updated” date at the top of this page always reflects the most recent material revision. Significant changes will be noted on the site. Continuing to use sanjaysokal.com after a change means you accept the revised policy.
14. Contact
For any privacy question, request or complaint:
Sanjay Sokal
Khairoli, Mahendergarh, Haryana, 123028
Email: sokalsanjay@gmail.com
Related pages: Cookie Policy · Terms & Conditions · Disclaimer